libsoup SoupServer HTTP Request Smuggling Vulnerability Allowing Denial-of-Service

A HTTP request smuggling vulnerability has been identified in libsoup's SoupServer component. This issue arises from improper handling of requests that use both Transfer-Encoding: chunked and Connection: keep-alive headers. As a result, a remote, unauthenticated client can exploit this vulnerability by sending specially crafted requests. The server fails to close the connection properly, as mandated by RFC 9112, allowing the attacker to smuggle additional requests over the persistent connection. This can lead to unintended request processing and potential denial-of-service conditions.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by disrupting normal server operations, potentially leading to increased resource consumption or application unavailability.